Class NagReportReader

java.lang.Object
com.cloudforgeci.api.core.rules.NagReportReader
public final class NagReportReader extends Object
Reads cdk-nag's own <PackName>-<StackName>-NagReport.json files back off disk after app.synth() completes, implementing ComplianceMode.ENFORCE's "blocks CDK synthesis" behavior. app.synth() itself never throws for a cdk-nag violation regardless of severity, so a caller has to inspect findings explicitly; this is that inspection point.

Deliberately file-based, not an INagLogger callback. Every NagPack in SecurityRules.mapFrameworkToNagPack(String, boolean) already sets reports(true), which enables cdk-nag's own built-in report logger (writing these exact files) with no extra registration needed. Registering an additional INagLogger alongside that built-in one triggers a jsii/cdk-nag runtime bug (a StackOverflowError from reentrant kernel calls, independent of what the extra logger's callbacks do), so reading the generated report after synthesis has already finished is both simpler and the only path that avoids it.

  • Method Details

    • readErrors

      public static List<NagReportReader.ComplianceFinding> readErrors(Path assemblyDirectory, String stackName)
      Every Non-Compliant, Error-level line across all *-NagReport.json files cdk-nag wrote for stackName into assemblyDirectory -- one file per applied framework/pack, hence scanning the whole directory rather than guessing a single exact filename. Compliant, suppressed, and warning-level lines are intentionally excluded -- only what ComplianceMode.ENFORCE actually needs to block on.

      Best-effort: a missing or unparseable report file is treated as "no findings from that file" rather than failing synthesis over a reporting problem — the same fail-soft posture the rest of this codebase's optional/best-effort reads already take.

    • readAll

      public static List<NagReportReader.ComplianceFinding> readAll(Path assemblyDirectory, String stackName)
      Every line across all *-NagReport.json files cdk-nag wrote for stackName, regardless of compliance/level -- compliant, suppressed, and warning-level lines included. Unlike readErrors(Path, String) (which exists to answer "must synthesis be blocked"), this exists to answer "what does a full compliance report for this stack look like", for a caller (an on-demand advisory check, not a real deploy) that wants to show the user everything cdk-nag has to say, not just what would fail an enforce-mode deploy.